I wouldn’t buy domains from Cloudflare from a risk mitigation perspective. At work I direct six figures of budget their way annually, but as a free-tier customer in my personal life I don’t trust them not to fuck up at some point and lock my account. If I register my domain elsewhere I can bring myself back online by moving the nameservers. If it’s registered at Cloudflare I’m fucked.
Your registrar (the place you buy your domains) is where you update your nameservers. If Cloudflare have locked you out then you won’t be able to change them. Other standard registrars will have far less cause, legitimate or not, to lock or disable your account, since they don’t host/proxy your content.